=== NETSENSAI Shield ===
Contributors: rgierlicki
Tags: security, cybersecurity, hardening, wordpress-security, protection
Requires at least: 5.6
Tested up to: 6.8
Stable tag: 1.4.2
License: GPLv2 or later
License URI: [https://www.gnu.org/licenses/gpl-2.0.html](https://www.gnu.org/licenses/gpl-2.0.html)

NETSENSAI Shield is a WordPress security plugin that hardens and protects your site by locking down login, REST API, XML-RPC, file editor, and applying security headers.

== Description ==

NETSENSAI Shield offers a range of security features, including:

* Changing the login URL to reduce brute force attack risks.
* Disabling the REST API (WP API JSON) for non-logged-in users.
* Disabling XML-RPC to prevent unauthorized access.
* Disabling the WordPress file editor to avoid accidental or malicious changes.
* Disabling Application Passwords to block unauthorized API access.
* **Applying advanced HTTP security headers (e.g., HSTS, X-Frame-Options, Content-Security-Policy).**
* **Integration with W3 Total Cache**:

  * Permanently disable `.htaccess` writes by W3TC,
  * Runtime disabling of Page Cache UI,
  * One-time full cache flush on first admin page load,
  * Automatic cache flush on Secure Options save,
  * Physical cleanup and permanent disable via the W3TC API.
* **Suppression of Site Health REST API availability notices** for non-logged-in users (removes false Site Health errors while maintaining full API blocking).

The free version provides both core and advanced Level 3 security functionalities. A PRO version offers extended support, additional features, and automatic protection enhancements.

== Installation ==

1. Download NETSENSAI Shield from the WordPress.org repository or upload the plugin files to `/wp-content/plugins/netsensai-shield/`.
2. Activate the plugin on the WordPress Admin Dashboard under **Plugins**.
3. Navigate to **Settings > Secure Options** and configure as needed.

== Frequently Asked Questions ==

= How do I change the WordPress login URL? =

Go to **Settings > Secure Options** and enter your preferred path in the **Change Login URL** field.

= How does disabling WP API JSON improve security? =

It reduces exposure of your site’s data via the REST API for non-logged-in users.

= Why disable XML-RPC? =

Disabling XML-RPC helps protect against brute force attacks targeting that protocol.

= What is the effect of disabling the file editor? =

It prevents code modifications via the dashboard, reducing the risk of malicious changes.

= What headers are included in Level 3 security? =

The plugin can apply:

* **Strict-Transport-Security (HSTS)**
* **X-Frame-Options**
* **X-Content-Type-Options**
* **Content-Security-Policy (CSP)**
* **Referrer-Policy**
* **Permissions-Policy**

= How does the W3 Total Cache integration work? =

On activation or settings save, NETSENSAI Shield clears the W3TC cache, disables the Page Cache UI to prevent conflicts, and blocks future `.htaccess` writes by W3TC.

= How does suppression of the Site Health REST API notice work? =

The plugin removes the default REST API availability test in Site Health for guest users, while still enforcing your REST API blocking settings.

== Screenshots ==

1. Secure Options Settings Page – intuitive panel for configuring security features.
2. Custom Login URL Setting – change your login path for improved security.
3. Disable XML-RPC and WP API JSON – restrict unauthorized access.
4. Security Headers Settings – activate HTTP headers with one click.
5. W3TC Integration Panel – view synchronization status with W3 Total Cache.

== Changelog ==

= 1.4.2 =
* Fixed README formatting (removed stray backslashes, added proper short description) so WordPress.org parses it correctly.
* Bumped stable tag and plugin version to 1.4.2.

= 1.4.1 =

* Reduced plugin tags to comply with WordPress.org (max 5).
* Short description shortened to fit 150 characters.
* Bumped stable tag and version to 1.4.1.

= 1.4 =

* Added **W3 Total Cache integration**:

  * Disabled `.htaccess` writes by W3TC,
  * Hid Page Cache UI at runtime,
  * One-time full cache flush on first admin page load,
  * Automatic cache flush on Secure Options save,
  * Physical cleanup & permanent disable via the W3TC API.
* Added **suppression of Site Health REST API availability test** for non-logged-in users.
* Documentation updated to reflect new features.

= 1.3 =

* Restored **Level 3: Advanced Security** options in the free version.
* Popup modal now shows only once when a feature is enabled.
* Fully localized modal text (`textdomain` ready).
* Fixed links to securityheaders.com and Mozilla Observatory.
* Removed `error_log()` calls flagged by Plugin Check.
* Minor UI & spacing fixes in popup design.
* Updated **Tested up to** to 6.8 and **Stable tag** to 1.3.

= 1.2 =

* Moved Level 3 features to the PRO version for better support and performance.
* Added a promotional message for the PRO version.
* Simplified the free version for clarity and speed.

= 1.1 =

* Added option to disable Application Passwords.
* Enhanced UI with tooltips and simplified options.
* Improved security headers implementation.
* Fixed issues with login URL redirection and WP API JSON disable functionality.

= 1.0 =

* Initial release featuring options to change the login URL, disable WP API JSON, XML-RPC, the file editor, and apply security headers.

== Upgrade Notice ==

= 1.4.2 =
This minor release fixes README parsing on WordPress.org by cleaning up the file formatting and bumps the version to 1.4.2.

= 1.4.1 =
This minor update reduces plugin tags to five, shortens the short description to comply with WordPress.org limits, and bumps the version to 1.4.1.

= 1.4 =
This release adds integration with W3 Total Cache (cache flushing, UI disable, `.htaccess` protection) and hides Site Health errors related to the REST API for non-logged-in users.

= 1.3 =
Level 3: Advanced Security features have been restored in the free version. Popup behavior improved, translations added, and Plugin Check compatibility enhanced.

= 1.2 =
Level 3 features were temporarily moved to the PRO version. Version 1.3 brings them back.